CompTIA CY0-001 Exam With Confidence Using Practice Dumps

Basic Concept: AI models trained on unrepresentative data can produce systematically inaccurate results for certain population groups. This is a form of algorithmic bias where the model ' s performance varies significantly across demographic segments, creating disparate outcomes. CompTIA SecAI+ Exam Objectives cover bias as a core AI governance and risk concept.

Why A is Correct: Bias in AI occurs when a model produces systematically skewed results for certain groups due to biased training data, flawed data collection, or model design choices. In this healthcare scenario, the inability to reliably predict illnesses for specific population segments indicates the training data likely underrepresented those segments, causing the model to learn inadequate patterns for them. This is a critical bias risk with serious health equity implications.

Why B is Wrong: Consistency refers to the model producing the same output given the same input across different runs or time periods. The problem described is not about inconsistent outputs for the same input but about systematically poor performance for specific population groups.

Why C is Wrong: Transparency refers to openness about how the AI model operates, what data it uses, and how it makes decisions. The compliance officer has already assessed the system, suggesting sufficient transparency exists to identify the performance gap.

Why D is Wrong: Inclusiveness is a design principle ensuring AI systems are designed to serve all users regardless of background. While related to the outcome, the specific risk type described — differential predictive accuracy across population segments — is most precisely categorized as bias.

Basic Concept: An on-path (formerly man-in-the-middle) attack intercepts communication between two parties, allowing the attacker to read, modify, or inject content. In the context of a generative AI application, an on-path attack on the session between user and AI service can manipulate prompts being sent to the model or responses being returned to users. CompTIA SecAI+ covers AI-specific attack vectors under securing AI systems.

Why B is Correct: Session hijacking involves an attacker taking control of an active user session by capturing or forging session tokens. In this attack, the attacker intercepts the communication channel between users and the AI application, allowing them to modify prompts sent to the model or replace legitimate model responses with offensive content. This explains why outputs seem unrelated to prompts and contain offensive material.

Why A is Wrong: Application server hijacking involves gaining unauthorized control of the server hosting the application. While severe, this would typically manifest as complete service disruption or data exfiltration rather than targeted modification of individual user session content.

Why C is Wrong: Domain hijacking involves unauthorized transfer of a domain name registration, redirecting all users to a different IP address. This would affect all users simultaneously and typically redirect to a completely different site rather than manipulating individual AI responses.

Why D is Wrong: Model hijacking refers to attacks that steal or replicate an AI model, not to intercepting and modifying the communication between users and an existing model during active sessions.

Basic Concept: Preventing prompt injection and ensuring output sanitization requires a control that can inspect both the semantic content of incoming prompts and the safety of outgoing responses. This requires an intelligent, context-aware filtering layer specifically designed for LLM traffic. CompTIA SecAI+ Study Guide identifies LLM firewalls as a primary control for prompt security and output safety.

Why C is Correct: An LLM firewall is specifically designed to inspect, filter, and sanitize both incoming prompts and outgoing AI responses. It can detect and block prompt injection attempts using pattern matching, semantic analysis, and behavioral heuristics, while also sanitizing output to remove sensitive data, harmful content, or policy violations before responses reach users. This dual capability makes it the primary control addressing both requirements simultaneously.

Why A is Wrong: Least privilege restricts what resources and actions users and systems can access. It reduces the potential impact of successful attacks but does not inspect prompt content for injection attempts or sanitize model outputs.

Why B is Wrong: Encryption protects data confidentiality in transit and at rest. It does not analyze prompt content for malicious patterns or filter AI-generated responses for unsafe content. Encrypted traffic can still carry prompt injection attacks.

Why D is Wrong: Rate limiting controls request frequency. While it can slow down automated injection attack campaigns, it does not inspect the content of individual prompts to detect injections, nor does it sanitize output responses. Malicious prompts can still succeed within rate limits.